Earlier quoted context omitted.
If everyone avoids using packages released within the last 7 days, malicious code is more likely to remain dormant for 7 days.
that's why people are telling others to use 7 days but using 8 days themselves :)
Genius
Axios compromised on NPM – Malicious versions drop remote access trojan
191–200 of 894 posts
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#192In case it helps, we open-sourced a tool to audit dependencies for this kind of supply-chain issue. The motivation was that there is a real gap between classic “known vulnerability” scanning and packages whose behavior has simply turned suspicious or malicious. We also use AI to analyze code and dependency changes for more novel or generic malicious behavior that traditional scanners often miss.
Project: https://point-wild.github.io/who-touched-my-packages/
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#193Hopefully desktop Linux users will start to understand that malware actually does exist for Linux and that their operating system is doing nothing to protect them from getting RATed.
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#194Not to beat a dead horse but I see this again and again with dependencies. Each time I get more worried that the same will happen with rust. I understand the fat std library approach won’t work but I really still want a good solution where I can trust packages to be safe and high quality.
Hosting curated dependencies is a commercially valuable service. Eventually an economy arises where people pay vendors to vet packages.
It's what linux distributions do.
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#195Is this an issue for those only using axios on the frontend side like in a VueJS app?
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#196Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#197Package managers are a failed experiment. We have libraries like SQLite, which is a single .c file that you drag into your project and it immediately does a ton of incredibly useful, non-trivial work for you, while barely increasing your executable's size. The issue is not dependencies themselves, it's transitive ones. Nobody installs left-pad or is-even-number directly, and "libraries" like these are the vast majori…
I don't think this community of professionals is going to come around to a solution which requires marginally more effort.
If no one checks their dependencies, the solution is to centralize this responsibility at the package repository. Something like left-pad should simply not be admitted to npm. Enforce a set of stricter rules which only allow non-trivial packages maintained by someone who is clearly accountable.
Another change one could make is develop bigger standard libraries with all the utilities which are useful. For example in Rust there are a few de facto standard packages one needs very often, which then also force you to pull in a bunch of transitive dependencies. Those could also be part of the standard library.
This all amounts to increasing the minimal scope of useful functionality a package has to have to be admitted and increasing accountability of the people maintaining them. This obviously comes with more effort on the maintainers part, but hey maybe we could even pay them for their labor.
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#198I recommend everyone to use bwrap if you're on linux and alias all package managers / anything that has post build logic with it. I have bwrap configured to override: npm, pip, cargo, mvn, gradle, everything you can think of and I only give it the access it needs, strip anything that is useless to it anyway, deny dbus, sockets, everything. SSH is forwarded via socket (ssh-add). This limits the blast radius to your CW…
I think firejail is a much more flexible security sandbox than bwrap. It also comes with pre-defined profiles
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#199Package managers are a failed experiment. We have libraries like SQLite, which is a single .c file that you drag into your project and it immediately does a ton of incredibly useful, non-trivial work for you, while barely increasing your executable's size. The issue is not dependencies themselves, it's transitive ones. Nobody installs left-pad or is-even-number directly, and "libraries" like these are the vast majori…
For some reason, NPM is the only ecosystem with substantial issues with supply-chain attacks.
The culture within the npm/js community has mainly been one of using the package manager rather than "re-inventing the wheel", as such the blast radius of a compromised package is much greater
Re: Axios compromised on NPM – Malicious versions drop remote access trojan
#200Good morning, or as they say in the NPM world, which package got compromised today?